feat(kernel): derivation-tree revocation, region caps

- caps record parent (mint/delegate/ipc), CapRef w/ pid+slot gens
- Revoke = delete subtree, keep self; drop/death re-parents children
- CreateRegion/MapRegion; mapping lives only as long as its cap
- drop Permission::Revoke + object-wide revoke
- mint any cap (badge only ep/ntfn), process caps delegable
- kani: descendants == subtree; model-based fuzz vs spec

crates/kernel/src/lib.rs

@@ -1,5 +1,6 @@
 #![no_std]
 
+mod captree;
 pub mod interrupt;
 mod memory;
 #[cfg(kani)]
@@ -278,6 +279,7 @@ impl<P: Platform> Kernel<P> {
         };
 
         self.cleanup_threads(&thread_ids);
+        self.delete_all_caps(pid);
         self.destroy_endpoints_owned_by(pid);
         self.destroy_notifications_owned_by(pid);
         self.teardown_memory(pid);
@@ -373,15 +375,6 @@ impl<P: Platform> Kernel<P> {
         }
     }
 
-    pub fn revoke_resource(&mut self, resource: &Resource) {
-        match resource {
-            Resource::Endpoint(id) => self.endpoints.revoke(*id),
-            Resource::Memory(id) => self.regions.revoke(*id),
-            Resource::Notification(id) => self.notifications.revoke(*id),
-            _ => {}
-        }
-    }
-
     fn grant_cap(
         &mut self,
         to: ProcessId,